Privacy Policy

1. Who we are

The 144th Glasgow (1st Baillieston) Scout Group is the data controller for the personal data described in this policy. We are a Scottish registered charity (SC032585) and operate as a volunteer-led youth organisation within The Scout Association.

We are committed to processing personal data fairly and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What personal data we collect and why

We only collect data that is necessary for the purpose it is being collected for. Below we explain each type of data we collect, why we collect it, and our legal basis for doing so under UK GDPR.

3. The 144 Swap Shop

The 144 Swap Shop is a public noticeboard where people pass on outgrown Scouting kit. This section explains, step by step, what happens to your information when you use it. The Swap Shop is for adults aged 18 or over: you confirm this each time you post or enquire, and that confirmation is recorded with the rest of your consent. If you are under 18, please ask a parent or carer to post or enquire for you.

How it works, and what happens to your data at each step

1. Confirming your email address. There are no accounts or passwords. You give us your email address and we email you a sign-in link. The link works once and expires after an hour; following it signs you in to the Swap Shop for seven days. Everyone gets a link, including our own families — it is how we know an address really belongs to the person using it, so that nobody can post or enquire in someone else’s name. We store only a scrambled (one-way hashed) copy of each link and sign-in token, never the token itself.
2. Posting a Listing. You write a title and description, choose the kit type and section, optionally add photographs, and say how you would prefer people to get in touch (email, phone call, text message or WhatsApp). The Listing text, photographs and that contact preference are published publicly. Your email address is never published, and we never ask you for a phone number when you post. We block phone numbers, email addresses and web links from the Listing text so that nobody publishes their contact details by accident.
3. The membership check. When you post, we compare your email address with the parent/carer and member contact addresses held for our current sections in Online Scout Manager (OSM). If it matches, your Listing goes up straight away; if not, it waits for a leader to check it, usually within a day or two. The check reads OSM; it does not change anything in OSM, and nobody else can see whether or not you are one of our families.
4. Moderation. Leaders who review Listings see the Listing, whether the address was recognised, and a masked version of your email address (for example j•••@example.com) — never the full address. If a Listing is rejected or taken down, we email you the reason.
5. Photographs. Every photograph is re-saved as it uploads, which removes the location and camera information phones attach. Please make sure no young person is identifiable in a photograph. Photographs are deleted from our storage the moment a Listing is Claimed, withdrawn, rejected or expires. Copies already cached by web browsers and Google’s content network can take up to a day to expire after that.
6. Enquiring about a Listing — the introduction. You give your name and a message, and choose how you would like to be contacted — email, phone call, text message, WhatsApp, or any combination; at least one. If you choose a phone option, you give us a phone number for that purpose. Before anything is sent you are shown exactly what will be shared and must confirm it. We then email your name, your message, your contact preferences and only the contact details you chose — your email address, your phone number or both — to the person who posted the Listing, and email you a copy of exactly what was passed on. If you untick email, they get your phone number but not your email address. Either way we keep the email address you signed in with, because every action on the Swap Shop is recorded against it (see the activity log below). This is the only way anyone’s contact details are ever shared. We never share a Lister’s email address with an enquirer.
7. After the introduction. The two of you carry on directly. The Group is a noticeboard, not a party to the exchange: we do not handle money, hold items, check that anything is as described, or arbitrate if something goes wrong. Anything you then exchange privately — by email, phone or WhatsApp — is between you and is outside this policy. Please meet somewhere sensible and use your own judgement.
8. Reports and safety. Anyone can report a Listing; a report records the reason, your email address if you choose to give it, and your IP address. Enquiry messages pass through the same safeguarding word filter as our news page, and a message it blocks is not sent.
9. The activity log. Every action on the Swap Shop — sign-in links requested and used, Listings posted, edited, extended, claimed or withdrawn, photographs uploaded, enquiries sent or blocked, reports, leaders’ decisions and automatic expiries — is recorded with the date and time, the email address involved and the IP address. It exists so that, if something goes wrong or a concern is raised, we can see exactly what happened. Only the Group’s administrators can see it, and every time it is viewed that is recorded too.

What we store, where, who can see it, and for how long

Legal basis under UK GDPR

• Consent (Article 6(1)(a)) — publishing your Listing, and sharing your details with the other person in an introduction. You give it by ticking the confirmation on the form, which shows the exact wording; we keep a record of that wording. You can withdraw consent at any time by withdrawing your Listing from My Listings or by emailing us. Withdrawing cannot recall details that have already been passed to someone in an introduction.
• Legitimate interests (Article 6(1)(f)) — the membership check, moderation, reports, the safeguarding filter, anti-abuse measures and the activity log. Our interest is running a noticeboard that is safe to have on a children’s charity’s website, and being able to investigate when something goes wrong. We keep this to what is needed: leaders see masked addresses, only administrators see the full record, and everything is deleted after 12 months. You can object to this processing by emailing us.
• Automated decisions — the membership check only decides whether your Listing goes up immediately or is checked by a leader first; nobody is refused automatically. If the safeguarding filter blocks wording, you can reword it or email us and a leader will help.

Where it is stored and how it is protected

• Records are held in Google Cloud Firestore in London (europe-west2) and processed by our Cloud Functions in the same region. Photographs are held in Google Cloud Storage in the EU. Emails are sent through the Group’s own Google Workspace account.
• Everything travels over encrypted connections (HTTPS) and is encrypted at rest by Google.
• The private records — email addresses, phone numbers, IP addresses, consent records and messages — can be read only by our server code and, through it, by administrators. They are never sent to anyone’s web browser except in the introduction and confirmation emails described above.
• Our database keeps a rolling seven-day recovery copy, so a record deleted under the periods above also leaves the recovery copy within seven days.
• Leaders and administrators are bound by the Group’s internal data protection guidance and must not copy Swap Shop records out of the system or use them for anything else.

Your rights on the Swap Shop

You can see, edit, extend, mark Claimed or withdraw your own Listings at any time from My Listings. For anything else — a copy of what we hold about you (including the activity log entries about you), correcting something, deleting your records sooner than 12 months, or objecting to any of the processing above — email data-protection@144glasgowscouts.org. We will reply within one month. If we need to keep a minimal record of an open report or safeguarding concern, we will tell you why. Your full rights are set out in section 8.

4. Who we share your data with

We do not sell personal data. We only share data with trusted third parties where it is necessary to deliver our services or where we are legally required to do so. All third-party processors are required to handle data securely and in accordance with UK GDPR.

5. International data transfers

Some of our third-party processors may transfer and process personal data outside the United Kingdom, including in the United States.

Where this occurs, we ensure that appropriate safeguards are in place. Google LLC participates in the EU–US Data Privacy Framework and provides Standard Contractual Clauses approved under UK GDPR to cover international transfers. Cloudflare operates under similar adequacy arrangements.

If you have questions about international transfers, please contact us.

6. Cookies and browser storage

Google Analytics (optional — requires your consent) — If you accept analytics cookies via the cookie banner, Google Analytics 4 sets cookies (_ga and _ga_*) to count aggregate page views. Nothing is set — and no analytics data is collected at all — until you accept. You can change your mind at any time using the "Cookie settings" link in the footer; rejecting removes the analytics cookies.

Your cookie choice — Whichever option you pick on the cookie banner is remembered in your browser's local storage (with a timestamp) so we don't keep asking. This record is strictly necessary and stays on your device.

Cloudflare Turnstile — Our contact and enquiry forms use Cloudflare Turnstile for anti-spam protection. Cloudflare may set a functional cookie or use local storage to verify you are human. This is strictly necessary for the forms to work and does not track you across websites.

144 Swap Shop sign-in — When you follow the link we email you to post on or enquire through the Swap Shop, we set a single cookie (__session) that keeps you signed in for seven days. It holds a random token and nothing else — no name, no email address — and it is only sent back to the Swap Shop pages. It is strictly necessary for posting and enquiring to work at all, so it does not need consent, and it is not used for analytics, advertising or tracking you anywhere else. Signing out clears it.

Authentication tokens — When leaders sign in to the leaders area, the browser stores a secure authentication token in local storage. This token is used only to keep you signed in during your session and is not shared with third parties. It expires automatically.

7. How long we keep your data

We retain personal data only for as long as necessary. The table below summarises our retention periods.

8. Your rights under UK GDPR

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions in some circumstances.

9. How to contact us

For any questions about this privacy policy, to exercise your data rights, or to raise a concern about how we handle personal data, please contact us:

10. Making a complaint

We take data protection seriously. You have the right to complain to us directly about how we have handled your personal data, and we encourage you to contact us first so we can try to put things right.

To make a data protection complaint, email data-protection@144glasgowscouts.org with the subject line "Data Protection Complaint" (or use info@144glasgowscouts.org). We will acknowledge your complaint within 30 days of receiving it, look into it properly — including taking any appropriate steps to resolve the issue — and let you know the outcome without undue delay.

If you are not satisfied with our response, you also have the right to lodge a complaint with the UK's data protection supervisory authority at any time:

11. Changes to this policy

We may update this privacy policy from time to time as our services change or as required by law. We will update the "Last updated" date at the top of this page when we do so.

This policy was last reviewed and updated on 24 September 2026.